Block emails spoofed p2 headers

You should be aware that a vast amount of legitimate mail is sent by third party services, and in most of those cases the P1 and P2 domains will not match.

Technically, the P1 information is supposed to be the identity of the user account which generated the message.   At some websites, if it knows you by your email address, and you use it to generate an email, it may send with your email address as P1.   I have given up on SPF.

Doug, please vote for and comment on: In Anti-Spam, Expression-check everything after DATA or include From

Cheers - Bob

UTM is a wrapper for the Exim MTA www.exim.org

Exim has a specialized filter language which has its own manual (which I have not studied)  

So the core product must have the ability, even though the UTM interface does not.   I suggest one of you raise a support case to try to induce them to help you configure your filter rule directly in Exim.

Then let us know the results...

Thanks Bob, I voted for your request. Actually I don't understand how this can be so complicated to implement. Well, I need to address this at the Exchange side then.

Thanks Bob, I voted for your request. Actually I don't understand how this can be so complicated to implement. Well, I need to address this at the Exchange side then.

I have read the Exim documentation and it does not appear that the filter engine extracts P2 From, so it appears to me that there is no way to filter on it at all.

Ah, that's too bad. Thanks for investigating anyway.

In V7.5, the Expression check allowed looking at the "To:" field, and we used that to quarantine emails sent to ex-employees.  Sometime in V8, that capability disappeared.  I don't recall if we used that ability to filter for spoofing in the "From:" field.

Cheers - Bob

astiadmin said:

Thanks Bob, I voted for your request. Actually I don't understand how this can be so complicated to implement. Well, I need to address this at the Exchange side then.

 

Hi Astiadmin,

is there a way to fix this at the Exchange? because I'm facing the same issue, and 

in-anti-spam-expression-check-everything-after-data

hasn't been addressed yet...

regards

Hi The Bee,

well, I found a way at least for my environment. I configured a dedicated FrontendTransport Connector for e-mails coming from the UTM only on both of my DAG members and ran the following Powershell command for each:

Remove-ADPermission <ReceiveConnector Name> –user “NT AUTHORITY\Anonymous Logon” –ExtendedRights ms-Exch-SMTP-Accept-Authoritative-Domain-Sender

Actually I don't know if it really works because I did not yet test it but according to web sources it should exactly do what we want here.

Regards
Daniel